Channel
@Bug_Alert
On this record: Topic · Growth · Engagement · Posts · Cite this entry
296subscribers
+28 since we began measuring on 7 August 2026
Risers and fallers across the register · movement among entries of Under 1,000.
| Telegram ID | -1003702168208 |
|---|---|
| Type | Channel |
| Username | @Bug_Alert |
| Created | Between 1 February 2026 and 31 July 2026 — estimated from Telegram’s id allocation, not measured. How this range is calculated. |
| First recorded | 8 August 2026 |
| Last confirmed live | 2 October 2026 |
| Measurements held | 9 |
| Confirmed unchanged | 1 time, most recently 2 October 2026 |
| On Telegram | t.me/Bug_Alert |
Hacking & security — a classification, not a measurement. An on-box language model (Qwen3.6-35B-A3B-FP8, prompt version 1) read this channel’s own recent posts on 23 September 2026 and assigned it the closest of 31 fixed categories, at 100% confidence. This is a model’s judgement about what the channel is likely to be about, not a fact this register measured the way a subscriber count or a view count is measured — it can be revised on a later pass, and it carries no weight anywhere else on this page. How this classification works, and why it has no browse page of its own yet.
| Measured (UTC) | Subscribers | Change |
|---|---|---|
| 2 Oct 2026, 13:00 | 296 | +23 |
| 17 Sept 2026, 08:02 | 273 | +1 |
| 8 Sept 2026, 09:16 | 272 | +1 |
| 29 Aug 2026, 04:17 | 271 | +4 |
| 21 Aug 2026, 08:04 | 267 | -4 |
| 14 Aug 2026, 19:58 | 271 | +2 |
| 8 Aug 2026, 08:49 | 269 | no change |
| 8 Aug 2026, 01:12 | 269 | +1 |
| 7 Aug 2026, 19:42 | 268 | first reading |
20 posts held, back to 8 August 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 1 page of Telegram’s post history, 20 posts per page.
Nothing published in the last 30 days. ERR and ER are rolling 30-day measures, so there is nothing to compute — we hold 20 posts for this entry, the most recent from 8 August 2026. An engagement rate over an empty window would be a number about nothing.
🔹 CVE-2026-65432 Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document...
Signed Bug Alert 🔔
🔹 CVE-2026-66909 Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remo...
Signed Bug Alert 🔔
🔹 CVE-2025-15028 The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to i...
Signed Bug Alert 🔔
🔹 CVE-2025-9266 The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ThemeGrill Demo Importer plugin...
Signed Bug Alert 🔔
🔹 CVE-2026-11983 The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check in the `ai_ajax` function. This makes it possible for unauthenticated attackers to view the contents of ad blocks that an administrator has restricted to administrator-o...
Signed Bug Alert 🔔
🔹 CVE-2026-19035 A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This project is superseded by F...
Signed Bug Alert 🔔
🔹 CVE-2026-57818 A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.
Signed Bug Alert 🔔
🔹 CVE-2026-5158 The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor...
Signed Bug Alert 🔔
🔹 CVE-2026-5391 The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This...
Signed Bug Alert 🔔
🔹 CVE-2026-61466 In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to...
Signed Bug Alert 🔔
🔹 CVE-2026-63687 Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, an...
Signed Bug Alert 🔔
🔹 CVE-2026-65583 Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in the validator. Users are recommended to upgrade to...
Signed Bug Alert 🔔
Showing the 12 most recent of 20 posts we hold for @Bug_Alert. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.
A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 2 October 2026 — this entry's latest reading, not the date you are reading this.
“Bug Alert 🔔” (@Bug_Alert), 296 subscribers as measured 2 October 2026. Telegram Register, tgregister.com/channel/Bug_Alert.
Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.